├── LICENSE
├── README.md
└── docs
├── CLOUD.md
├── CODE.md
├── DEPLOYMENT.md
├── DNS.md
├── EVERYTHING.md
├── HARDWARE.md
├── INTEGRATION.md
├── LOCAL.md
├── PEOPLE.md
├── RUNTIME.md
├── SERVICES.md
└── images
├── .DS_Store
├── Software-Supply-Chain-Visualization.png
├── akamai.svg
├── alibaba-cloud.png
├── amazon-linux-logo.png
├── amazon-linux.png
├── angular.svg
├── apache.svg
├── aspnet.png
├── atom.png
├── aws-api-gateway.svg
├── aws-cognito.svg
├── aws.svg
├── azure-devops.svg
├── azure-repos.png
├── azure.svg
├── babel.svg
├── bamboo.png
├── bitbucket.svg
├── braintree.png
├── buildkite.png
├── clearcase.png
├── cloud-ssc.png
├── cloudflare.svg
├── cloudfront.svg
├── codecommit.png
├── collaborators-github.png
├── collaborators-github2.png
├── composer.png
├── contentful.svg
├── cplusplus.png
├── crunchbase.png
├── csharp.png
├── deployment-ssc.png
├── django.svg
├── dns-ssc.png
├── docker.png
├── drupal.svg
├── express.svg
├── facebook.svg
├── fastapi.svg
├── fastly.svg
├── firebase.svg
├── flywheel.svg
├── freebsd.png
├── git.svg
├── gitea.png
├── github-visualizing-software-supply-chain.jpeg
├── github.svg
├── gitlab.svg
├── glassfish.png
├── go.svg
├── google-analytics.svg
├── google-cloud.svg
├── hardware-ssc.png
├── hotjar.svg
├── hubspot.svg
├── integration-ssc.png
├── java.svg
├── javascript.svg
├── jenkins.svg
├── joomla.png
├── jquery.svg
├── kinsta.svg
├── knockout.svg
├── kubernetes.svg
├── laravel.svg
├── linkedin.svg
├── linux.svg
├── local-ssc.png
├── lodash.svg
├── lua.svg
├── magento.svg
├── mailchimp.svg
├── marketo.svg
├── maven.svg
├── mercurial.png
├── microsoft-iis-logo.png
├── microsoft-sql-server-logo.svg
├── mixpanel.png
├── moment-js.svg
├── mysql.svg
├── netcore.svg
├── next-js.svg
├── nginx.svg
├── npm.png
├── nuget.png
├── nuxt-js.svg
├── octopus-deploy.png
├── octopus-deploy.svg
├── packagist.png
├── paypal.svg
├── peakhour.png
├── people-ssc.png
├── php.svg
├── postgres.svg
├── pypi.png
├── python.svg
├── react.svg
├── redhat.png
├── redhat.svg
├── redis.svg
├── require-js.svg
├── ruby-on-rails.svg
├── ruby.svg
├── runtime-ssc.png
├── rust.svg
├── segment.svg
├── services-ssc.png
├── slick.svg
├── source-code-ssc.png
├── square.jpeg
├── ssc-new-image.png
├── stripe.svg
├── swiper.svg
├── tailwind.svg
├── tomcat.svg
├── ubuntu.svg
├── underscore.svg
├── unix.svg
├── vercel.svg
├── vim.png
├── vscode.png
├── vue.svg
├── websphere.png
├── windows-server.svg
├── wordpress.svg
└── yarn.png
/LICENSE:
--------------------------------------------------------------------------------
1 | MIT License
2 |
3 | Copyright (c) 2023 SecureStackCo
4 |
5 | Permission is hereby granted, free of charge, to any person obtaining a copy
6 | of this software and associated documentation files (the "Software"), to deal
7 | in the Software without restriction, including without limitation the rights
8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 |
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 |
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | 
2 |
3 | The software supply chain is under increasing threat. New attacks and threats have popped up that we couldn't have imagined even two years ago. Total attacks on the software supply chain are increasing by more than [730% year on year since 2019](https://portswigger.net/daily-swig/researchers-find-633-increase-in-cyber-attacks-aimed-at-open-source-repositories)
4 |
5 | Unfortunately, there is no commonly accepted definition of what is in the software supply chain. This is a problem as we can't secure the software supply chain if we don't know what's in it. This project aims to help fix that by giving people a visual and contextual way to understand what specific components are in a particular software supply chain. If you want to tag your own components you can fork this repo and edit it to suit your specific software supply chain profiles. This repository takes advantage of the [DevSecOps Playbook](https://github.com/6mile/DevSecOps-Playbook) for the security control examples.
6 |
7 |
8 |
9 | ## The Software Supply Chain Stages
10 |
11 | | [People](docs/PEOPLE.md#people) | [Local Reqs](docs/LOCAL.md#local-requirements) | [Source Code](docs/CODE.md#source-code) | [Integration](docs/INTEGRATION.md#continuous-integration) | [Deployment](docs/DEPLOYMENT.md#continuous-deployment) | [Runtime](docs/RUNTIME.md#runtime) | [Hardware](docs/HARDWARE.md#hardware) | [DNS](docs/DNS.md#dns) | [Services](docs/SERVICES.md#services) | [Cloud](docs/CLOUD.md#cloud-resources)
12 | | :---------: | :----------: | :--------------: | :-----------: | :------------------: | :-----------------: | :---------: | :------: | :----------------: | :---------:
13 | | | | | | | | | | | |
14 | | Developers | IDE | Languages | SCM providers | Build solutions | Servers | Embedded PC | URL | SaaS solutions | CDN |
15 | | QA team | SCV | Frameworks | Pull requests | Deployment platforms | Operating systems | PCB | hostname | Third party APIs | Cloud services |
16 | | DevOps team | Local tests | Libraries | Secrets mgmt | Releases | Webservers | USB dongle | | Payment gateways | |
17 | | Package Maintainers | Git repos | Package Managers | Git repos | Functional tests | Application servers | GPU/CPU | | Identity Providers | |
18 | | | Page Builders | Packages | | Security tests | Web engines | | | Analytics | |
19 | | | | Open source | | API test frameworks | Databases | | | Proxies | |
20 | | | | Proprietary Code | | Unit tests | | | | | |
21 | | | | | | | | | | | |
22 | | [People](docs/PEOPLE.md#people) | [Local Reqs](docs/LOCAL.md#local-requirements) | [Source Code](docs/CODE.md#source-code) | [Integration](docs/INTEGRATION.md#continuous-integration) | [Deployment](docs/DEPLOYMENT.md#continuous-deployment) | [Runtime](docs/RUNTIME.md#runtime) | [Hardware](docs/HARDWARE.md#hardware) | [DNS](docs/DNS.md#dns) | [Services](docs/SERVICES.md#services) | [Cloud](docs/CLOUD.md#cloud-resources)
23 |
24 |
25 |
26 | ## Welcome to the "Visualizing the Software Supply Chain" repository!
27 |
28 | You can click on any of the links above and see examples of components sorted by category. You can also see specific examples of technologies and vendors that fall into that category as well. Enjoy!
29 |
30 | If you want to see everything on one page, you can select [EVERYTHING](./docs/EVERYTHING.md)
31 |
--------------------------------------------------------------------------------
/docs/CLOUD.md:
--------------------------------------------------------------------------------
1 |
2 |
3 | ## The Software Supply Chain Stages
4 |
5 | | [People](PEOPLE.md#people) | [Local Reqs](LOCAL.md#local-requirements) | [Source Code](CODE.md#source-code) | [Integration](INTEGRATION.md#continuous-integration) | [Deployment](DEPLOYMENT.md#continuous-deployment) | [Runtime](RUNTIME.md#runtime) | [Hardware](HARDWARE.md#hardware) | [DNS](DNS.md#dns) | [Services](SERVICES.md#services) | [Cloud](CLOUD.md#cloud-resources)
6 | | :---------: | :----------: | :--------------: | :-----------: | :------------------: | :-----------------: | :---------: | :------: | :----------------: | :---------:
7 | | | | | | | | | | | |
8 | | Developers | IDE | Languages | SCM providers | Build solutions | Servers | Embedded PC | URL | SaaS solutions | CDN |
9 | | QA team | SCV | Frameworks | Pull requests | Deployment platforms | Operating systems | PCB | hostname | Third party APIs | Cloud services |
10 | | DevOps team | Local tests | Libraries | Secrets mgmt | Releases | Webservers | USB dongle | | Payment gateways | |
11 | | Package Maintainers | Git repos | Package Managers | Git repos | Functional tests | Application servers | GPU/CPU | | Identity Providers | |
12 | | | Page Builders | Packages | | Security tests | Web engines | | | Analytics | |
13 | | | | Open source | | API test frameworks | Databases | | | Proxies | |
14 | | | | Proprietary Code | | Unit tests | | | | | |
15 | | | | | | | | | | | |
16 | | [People](PEOPLE.md#people) | [Local Reqs](LOCAL.md#local-requirements) | [Source Code](CODE.md#source-code) | [Integration](INTEGRATION.md#continuous-integration) | [Deployment](DEPLOYMENT.md#continuous-deployment) | [Runtime](RUNTIME.md#runtime) | [Hardware](HARDWARE.md#hardware) | [DNS](DNS.md#dns) | [Services](SERVICES.md#services) | [Cloud](CLOUD.md#cloud-resources)
17 |
18 |
19 |
20 | ## Cloud resources
21 |
22 | Cloud native resources refer to the tools, technologies, and infrastructure required to develop, deploy, and manage applications that are designed to run in a cloud environment. These resources typically include containerization platforms, orchestration frameworks, serverless computing, and other cloud-specific technologies.
23 |
24 | ### What's in scope?
25 |
26 | * PaaS
27 | * CDN
28 | * Cloud hosting providers
29 | * Cloud native resources
30 |
31 | ### Examples
32 |
33 | #### PaaS Examples
34 |
35 |
36 |
37 | #### CDN Examples
38 |
39 |
40 |
41 | #### Cloud hosting providers
42 |
43 |
44 |
45 | #### Cloud Native Services
46 |
47 |
48 |
49 | DynamoDB, Azure Functions, Microsoft Power Apps, Azure Cosmos, Azure Application Gateway, AWS Elastic Load Balancer, AWS Certificate Manager
50 |
51 | ### Who owns it?
52 |
53 | * CloudOps team
54 | * DevOps team
55 |
56 | ### What are the security concerns?
57 |
58 | * Reference the shared responsibility model
59 | * Many of the cloud services are publicly facing endpoints by default
60 | * What permissions are the cloud services using?
61 | * How many assets do you have in the cloud?
62 |
63 | ### How do I secure it?
64 |
65 | * Cloud Security Posture Mananagement
66 | * Attack surface mapping
67 |
--------------------------------------------------------------------------------
/docs/CODE.md:
--------------------------------------------------------------------------------
1 |
2 |
3 | ## The Software Supply Chain Stages
4 |
5 | | [People](PEOPLE.md#people) | [Local Reqs](LOCAL.md#local-requirements) | [Source Code](CODE.md#source-code) | [Integration](INTEGRATION.md#continuous-integration) | [Deployment](DEPLOYMENT.md#continuous-deployment) | [Runtime](RUNTIME.md#runtime) | [Hardware](HARDWARE.md#hardware) | [DNS](DNS.md#dns) | [Services](SERVICES.md#services) | [Cloud](CLOUD.md#cloud-resources)
6 | | :---------: | :----------: | :--------------: | :-----------: | :------------------: | :-----------------: | :---------: | :------: | :----------------: | :---------:
7 | | | | | | | | | | | |
8 | | Developers | IDE | Languages | SCM providers | Build solutions | Servers | Embedded PC | URL | SaaS solutions | CDN |
9 | | QA team | SCV | Frameworks | Pull requests | Deployment platforms | Operating systems | PCB | hostname | Third party APIs | Cloud services |
10 | | DevOps team | Local tests | Libraries | Secrets mgmt | Releases | Webservers | USB dongle | | Payment gateways | |
11 | | Package Maintainers | Git repos | Package Managers | Git repos | Functional tests | Application servers | GPU/CPU | | Identity Providers | |
12 | | | Page Builders | Packages | | Security tests | Web engines | | | Analytics | |
13 | | | | Open source | | API test frameworks | Databases | | | Proxies | |
14 | | | | Proprietary Code | | Unit tests | | | | | |
15 | | | | | | | | | | | |
16 | | [People](PEOPLE.md#people) | [Local Reqs](LOCAL.md#local-requirements) | [Source Code](CODE.md#source-code) | [Integration](INTEGRATION.md#continuous-integration) | [Deployment](DEPLOYMENT.md#continuous-deployment) | [Runtime](RUNTIME.md#runtime) | [Hardware](HARDWARE.md#hardware) | [DNS](DNS.md#dns) | [Services](SERVICES.md#services) | [Cloud](CLOUD.md#cloud-resources)
17 |
18 |
19 |
20 | ## Source Code
21 |
22 | This includes any software that is needed to successfully write, build or deploy an application.
23 |
24 | ### What's in scope?
25 |
26 | * Programming languages
27 | * Frameworks
28 | * Libraries
29 | * Package managers
30 | * Open source components
31 | * Proprietary code
32 |
33 | ### Examples
34 |
35 | #### Programming Languages
36 |
37 |
38 |
39 | #### Frameworks & libraries
40 |
41 |
42 |
43 | #### Package managers
44 |
45 |
46 |
47 | ### Who owns it?
48 |
49 | * Development teams
50 | * DevOps team
51 |
52 | ### What are the security concerns?
53 |
54 | * Knowing what's in your software is the first key
55 | * Source code components are coming from many different sources and used in applications
56 | * Dependency origin for the source code we use is critically important
57 | * Package managers are a primary target for attackers
58 |
59 | ### How do I secure it?
60 |
61 | * Use secure package repositories
62 | * Analysis source code composition
63 | * Software bill of materials
64 |
--------------------------------------------------------------------------------
/docs/DEPLOYMENT.md:
--------------------------------------------------------------------------------
1 |
2 |
3 | ## The Software Supply Chain Stages
4 |
5 | | [People](PEOPLE.md#people) | [Local Reqs](LOCAL.md#local-requirements) | [Source Code](CODE.md#source-code) | [Integration](INTEGRATION.md#continuous-integration) | [Deployment](DEPLOYMENT.md#continuous-deployment) | [Runtime](RUNTIME.md#runtime) | [Hardware](HARDWARE.md#hardware) | [DNS](DNS.md#dns) | [Services](SERVICES.md#services) | [Cloud](CLOUD.md#cloud-resources)
6 | | :---------: | :----------: | :--------------: | :-----------: | :------------------: | :-----------------: | :---------: | :------: | :----------------: | :---------:
7 | | | | | | | | | | | |
8 | | Developers | IDE | Languages | SCM providers | Build solutions | Servers | Embedded PC | URL | SaaS solutions | CDN |
9 | | QA team | SCV | Frameworks | Pull requests | Deployment platforms | Operating systems | PCB | hostname | Third party APIs | Cloud services |
10 | | DevOps team | Local tests | Libraries | Secrets mgmt | Releases | Webservers | USB dongle | | Payment gateways | |
11 | | Package Maintainers | Git repos | Package Managers | Git repos | Functional tests | Application servers | GPU/CPU | | Identity Providers | |
12 | | | Page Builders | Packages | | Security tests | Web engines | | | Analytics | |
13 | | | | Open source | | API test frameworks | Databases | | | Proxies | |
14 | | | | Proprietary Code | | Unit tests | | | | | |
15 | | | | | | | | | | | |
16 | | [People](PEOPLE.md#people) | [Local Reqs](LOCAL.md#local-requirements) | [Source Code](CODE.md#source-code) | [Integration](INTEGRATION.md#continuous-integration) | [Deployment](DEPLOYMENT.md#continuous-deployment) | [Runtime](RUNTIME.md#runtime) | [Hardware](HARDWARE.md#hardware) | [DNS](DNS.md#dns) | [Services](SERVICES.md#services) | [Cloud](CLOUD.md#cloud-resources)
17 |
18 |
19 |
20 | ## Continuous deployment
21 |
22 | Continuous delivery is an extension of continuous integration that automatically deploys all code changes to a testing and/or production environment after the build stage. This means that in addition to automated testing, you have an automated release process, and can deploy your application at any time by clicking a button.
23 |
24 | ### What's in scope?
25 |
26 | * Build servers
27 | * Deployment platforms
28 | * Security tests
29 | * Functional tests
30 |
31 | ### Examples
32 |
33 |
34 |
35 | Bamboo, Selenium, Semgrep, SecureStack
36 |
37 | ### Who owns it?
38 |
39 | * CloudOps team
40 | * DevOps team
41 |
42 | ### What are the security concerns?
43 |
44 | * Are disposable build environments secure?
45 | * Are components being used during CI/CD known good?
46 | * Security scans are automated as part of the deployment process
47 |
48 | ### How do I secure it?
49 |
50 | * Dynamic application security testing
51 | * Static analysis security testing
52 |
--------------------------------------------------------------------------------
/docs/DNS.md:
--------------------------------------------------------------------------------
1 |
2 |
3 | ## The Software Supply Chain Stages
4 |
5 | | [People](PEOPLE.md#people) | [Local Reqs](LOCAL.md#local-requirements) | [Source Code](CODE.md#source-code) | [Integration](INTEGRATION.md#continuous-integration) | [Deployment](DEPLOYMENT.md#continuous-deployment) | [Runtime](RUNTIME.md#runtime) | [Hardware](HARDWARE.md#hardware) | [DNS](DNS.md#dns) | [Services](SERVICES.md#services) | [Cloud](CLOUD.md#cloud-resources)
6 | | :---------: | :----------: | :--------------: | :-----------: | :------------------: | :-----------------: | :---------: | :------: | :----------------: | :---------:
7 | | | | | | | | | | | |
8 | | Developers | IDE | Languages | SCM providers | Build solutions | Servers | Embedded PC | URL | SaaS solutions | CDN |
9 | | QA team | SCV | Frameworks | Pull requests | Deployment platforms | Operating systems | PCB | hostname | Third party APIs | Cloud services |
10 | | DevOps team | Local tests | Libraries | Secrets mgmt | Releases | Webservers | USB dongle | | Payment gateways | |
11 | | Package Maintainers | Git repos | Package Managers | Git repos | Functional tests | Application servers | GPU/CPU | | Identity Providers | |
12 | | | Page Builders | Packages | | Security tests | Web engines | | | Analytics | |
13 | | | | Open source | | API test frameworks | Databases | | | Proxies | |
14 | | | | Proprietary Code | | Unit tests | | | | | |
15 | | | | | | | | | | | |
16 | | [People](PEOPLE.md#people) | [Local Reqs](LOCAL.md#local-requirements) | [Source Code](CODE.md#source-code) | [Integration](INTEGRATION.md#continuous-integration) | [Deployment](DEPLOYMENT.md#continuous-deployment) | [Runtime](RUNTIME.md#runtime) | [Hardware](HARDWARE.md#hardware) | [DNS](DNS.md#dns) | [Services](SERVICES.md#services) | [Cloud](CLOUD.md#cloud-resources)
17 |
18 |
19 |
20 | ## DNS
21 |
22 | This includes any hostnames, or other DNS entries that any application needs.
23 |
24 | ### What's in scope?
25 |
26 | * DNS
27 |
28 | ### Examples
29 |
30 | app.example.org
31 |
32 | ### Who owns it?
33 |
34 | * CloudOps team
35 | * Operations team
36 |
37 | ### How do I secure it?
38 |
39 | *
40 |
--------------------------------------------------------------------------------
/docs/EVERYTHING.md:
--------------------------------------------------------------------------------
1 |
2 |
3 | ## The Software Supply Chain Stages
4 |
5 | | [People](PEOPLE.md#people) | [Local Reqs](LOCAL.md#local-requirements) | [Source Code](CODE.md#source-code) | [Integration](INTEGRATION.md#continuous-integration) | [Deployment](DEPLOYMENT.md#continuous-deployment) | [Runtime](RUNTIME.md#runtime) | [Hardware](HARDWARE.md#hardware) | [DNS](DNS.md#dns) | [Services](SERVICES.md#services) | [Cloud](CLOUD.md#cloud-resources)
6 | | :---------: | :----------: | :--------------: | :-----------: | :------------------: | :-----------------: | :---------: | :------: | :----------------: | :---------:
7 | | | | | | | | | | | |
8 | | Developers | IDE | Languages | SCM providers | Build solutions | Servers | Embedded PC | URL | SaaS solutions | CDN |
9 | | QA team | SCV | Frameworks | Pull requests | Deployment platforms | Operating systems | PCB | hostname | Third party APIs | Cloud services |
10 | | DevOps team | Local tests | Libraries | Secrets mgmt | Releases | Webservers | USB dongle | | Payment gateways | |
11 | | Package Maintainers | Git repos | Package Managers | Git repos | Functional tests | Application servers | GPU/CPU | | Identity Providers | |
12 | | | Page Builders | Packages | | Security tests | Web engines | | | Analytics | |
13 | | | | Open source | | API test frameworks | Databases | | | Proxies | |
14 | | | | Proprietary Code | | Unit tests | | | | | |
15 | | | | | | | | | | | |
16 | | [People](PEOPLE.md#people) | [Local Reqs](LOCAL.md#local-requirements) | [Source Code](CODE.md#source-code) | [Integration](INTEGRATION.md#continuous-integration) | [Deployment](DEPLOYMENT.md#continuous-deployment) | [Runtime](RUNTIME.md#runtime) | [Hardware](HARDWARE.md#hardware) | [DNS](DNS.md#dns) | [Services](SERVICES.md#services) | [Cloud](CLOUD.md#cloud-resources)
17 |
18 |
19 |
20 | ## People
21 |
22 | These are the individuals or teams of people that are needed to write, build and deploy software.
23 |
24 | ### What's in scope?
25 |
26 | * Software engineers
27 | * QA team
28 | * DevOps team
29 |
30 | ### Examples
31 |
32 | #### Developers
33 |
34 | 
35 |
36 |
37 |
38 | ## Local Requirements
39 |
40 | This includes any local applications, configurations, or other dependencies that are needed to for the people building software to successfully do their job.
41 |
42 | ### What's in scope?
43 |
44 | * IDE
45 | * VCS tools
46 | * Local tests
47 |
48 | ### Examples
49 |
50 | #### IDE
51 |
52 |
53 |
54 | #### VCS Tools
55 |
56 |
57 |
58 | #### Local tests
59 |
60 | Linting, static analysis, software composition analysis
61 |
62 |
63 |
64 | ## Source Code
65 |
66 | This includes any software that is needed to successfully write, build or deploy an application.
67 |
68 | ### What's in scope?
69 |
70 | * Programming languages
71 | * Frameworks
72 | * Libraries
73 | * Open source components
74 | * Proprietary code
75 |
76 | ### Examples
77 |
78 | #### Programming Languages
79 |
80 |
81 |
82 | #### Frameworks & libraries
83 |
84 |
85 |
86 | ## Continuous Integration
87 |
88 | Continuous integration (CI) is the process of automatically integrating code changes from multiple contributors into a single software project. This is an important DevOps best practice that enables developers to frequently merge code changes into a central repository for testing before deployment. Automated tools are used to check that the new code is correct before integration.
89 |
90 | ### What's in scope?
91 |
92 | * SCM providers
93 | * Pull requests
94 |
95 | ### Examples
96 |
97 | #### SCM Providers
98 |
99 |
100 |
101 | ## Continuous deployment
102 |
103 | Continuous delivery is an extension of continuous integration that automatically deploys all code changes to a testing and/or production environment after the build stage. This means that in addition to automated testing, you have an automated release process, and can deploy your application at any time by clicking a button.
104 |
105 | ### What's in scope?
106 |
107 | * Build servers
108 | * Deployment platforms
109 | * Security tests
110 | * Functional tests
111 |
112 | ### Examples
113 |
114 |
115 |
116 | Bamboo, Selenium, Semgrep, SecureStack
117 |
118 |
119 |
120 | ## Runtime
121 |
122 | The web application runtime is the environment in which a web application is executed. It typically includes the web server, the application server, and other necessary components such as databases, messaging systems, and caching mechanisms. The runtime is responsible for managing the application's resources, handling incoming requests, and returning responses to users.
123 |
124 | ### What's in scope
125 |
126 | * Operating systems
127 | * Webservers
128 | * Application servers
129 | * Content management systems
130 | * Web runtime engines
131 | * Databases
132 | * Containers, AMIs & golden images
133 |
134 | ### Examples
135 |
136 | #### Operating systems
137 |
138 |
139 |
140 | #### Webservers
141 |
142 |
143 |
144 | #### Application servers
145 |
146 |
147 |
148 | #### Content management systems
149 |
150 |
151 |
152 | Clarity, Kentico, Sharepoint, Adobe Experience Manager
153 |
154 | #### Web runtime
155 |
156 | Node.js, WebKit, Chrome, V8
157 |
158 | #### Databases
159 |
160 |
161 |
162 | #### Containers, AMIs & Golden Images
163 |
164 |
165 |
166 |
167 |
168 | ## Hardware
169 |
170 | This includes any specific or customized piece of hardware for this application to run.
171 |
172 | ### What's in scope?
173 |
174 | * Proprietary devices
175 | * Dedicated servers
176 |
177 | ### Examples
178 |
179 | Embedded devices, custom PCBs, GPUs
180 |
181 |
182 |
183 | ## DNS
184 |
185 | This includes any hostnames, or other DNS entries that any application needs.
186 |
187 | ### What's in scope?
188 |
189 | * DNS
190 |
191 | ### Examples
192 |
193 | app.example.org
194 |
195 |
196 |
197 | ## Services
198 |
199 | This refers to the process of identifying and describing the external services that a application relies on in order to function properly. These third-party services can include anything from authentication and authorization services to payment processing and analytics tools.
200 |
201 | ### What's in scope?
202 |
203 | * third party SaaS solutions
204 | * third party APIs or data
205 | * payment processors/gateways
206 | * identity providers
207 | * analytics & tracking
208 |
209 | ### Examples
210 |
211 | #### Payment gateways & processors
212 |
213 |
214 |
215 | #### SaaS solutions examples
216 |
217 |
218 |
219 | #### Analytics & tracking examples
220 |
221 |
222 |
223 |
224 |
225 | ## Cloud resources
226 |
227 | Cloud native resources refer to the tools, technologies, and infrastructure required to develop, deploy, and manage applications that are designed to run in a cloud environment. These resources typically include containerization platforms, orchestration frameworks, serverless computing, and other cloud-specific technologies.
228 |
229 | ### What's in scope?
230 |
231 | * PaaS
232 | * CDN
233 | * Cloud hosting providers
234 | * Cloud native resources
235 |
236 | ### Examples
237 |
238 | #### PaaS Examples
239 |
240 |
241 |
242 | #### CDN Examples
243 |
244 |
245 |
246 | #### Cloud hosting providers
247 |
248 |
249 |
250 | #### Cloud Native Services
251 |
252 |
253 |
254 | DynamoDB, Azure Functions, Microsoft Power Apps, Azure Cosmos, Azure Application Gateway, AWS Elastic Load Balancer, AWS Certificate Manager
255 |
--------------------------------------------------------------------------------
/docs/HARDWARE.md:
--------------------------------------------------------------------------------
1 |
2 |
3 | ## The Software Supply Chain Stages
4 |
5 | | [People](PEOPLE.md#people) | [Local Reqs](LOCAL.md#local-requirements) | [Source Code](CODE.md#source-code) | [Integration](INTEGRATION.md#continuous-integration) | [Deployment](DEPLOYMENT.md#continuous-deployment) | [Runtime](RUNTIME.md#runtime) | [Hardware](HARDWARE.md#hardware) | [DNS](DNS.md#dns) | [Services](SERVICES.md#services) | [Cloud](CLOUD.md#cloud-resources)
6 | | :---------: | :----------: | :--------------: | :-----------: | :------------------: | :-----------------: | :---------: | :------: | :----------------: | :---------:
7 | | | | | | | | | | | |
8 | | Developers | IDE | Languages | SCM providers | Build solutions | Servers | Embedded PC | URL | SaaS solutions | CDN |
9 | | QA team | SCV | Frameworks | Pull requests | Deployment platforms | Operating systems | PCB | hostname | Third party APIs | Cloud services |
10 | | DevOps team | Local tests | Libraries | Secrets mgmt | Releases | Webservers | USB dongle | | Payment gateways | |
11 | | Package Maintainers | Git repos | Package Managers | Git repos | Functional tests | Application servers | GPU/CPU | | Identity Providers | |
12 | | | Page Builders | Packages | | Security tests | Web engines | | | Analytics | |
13 | | | | Open source | | API test frameworks | Databases | | | Proxies | |
14 | | | | Proprietary Code | | Unit tests | | | | | |
15 | | | | | | | | | | | |
16 | | [People](PEOPLE.md#people) | [Local Reqs](LOCAL.md#local-requirements) | [Source Code](CODE.md#source-code) | [Integration](INTEGRATION.md#continuous-integration) | [Deployment](DEPLOYMENT.md#continuous-deployment) | [Runtime](RUNTIME.md#runtime) | [Hardware](HARDWARE.md#hardware) | [DNS](DNS.md#dns) | [Services](SERVICES.md#services) | [Cloud](CLOUD.md#cloud-resources)
17 |
18 |
19 |
20 | ## Hardware
21 |
22 | This includes any specific or customized piece of hardware for this application to run.
23 |
24 | ### What's in scope?
25 |
26 | * Proprietary devices
27 | * Dedicated servers
28 |
29 | ### Examples
30 |
31 | Embedded devices, custom PCBs, GPUs
32 |
33 | ### Who owns it?
34 |
35 | * Operations team
36 | * Cloud provider
37 |
38 | ### What are the security concerns?
39 |
40 | * Hardware devices come with embedded software that is an attack vector
41 | * Theft of small portable devices like USB keys
42 | * Modification of the devices by malicious actors
43 |
44 | ### How do I secure it?
45 |
46 | * Buy from known supplier
47 | * Network analysis so you can detect malicious "phone home"
48 | * Physical isolation and/or network segmentation
49 |
--------------------------------------------------------------------------------
/docs/INTEGRATION.md:
--------------------------------------------------------------------------------
1 |
2 |
3 | ## The Software Supply Chain Stages
4 |
5 | | [People](PEOPLE.md#people) | [Local Reqs](LOCAL.md#local-requirements) | [Source Code](CODE.md#source-code) | [Integration](INTEGRATION.md#continuous-integration) | [Deployment](DEPLOYMENT.md#continuous-deployment) | [Runtime](RUNTIME.md#runtime) | [Hardware](HARDWARE.md#hardware) | [DNS](DNS.md#dns) | [Services](SERVICES.md#services) | [Cloud](CLOUD.md#cloud-resources)
6 | | :---------: | :----------: | :--------------: | :-----------: | :------------------: | :-----------------: | :---------: | :------: | :----------------: | :---------:
7 | | | | | | | | | | | |
8 | | Developers | IDE | Languages | SCM providers | Build solutions | Servers | Embedded PC | URL | SaaS solutions | CDN |
9 | | QA team | SCV | Frameworks | Pull requests | Deployment platforms | Operating systems | PCB | hostname | Third party APIs | Cloud services |
10 | | DevOps team | Local tests | Libraries | Secrets mgmt | Releases | Webservers | USB dongle | | Payment gateways | |
11 | | Package Maintainers | Git repos | Package Managers | Git repos | Functional tests | Application servers | GPU/CPU | | Identity Providers | |
12 | | | Page Builders | Packages | | Security tests | Web engines | | | Analytics | |
13 | | | | Open source | | API test frameworks | Databases | | | Proxies | |
14 | | | | Proprietary Code | | Unit tests | | | | | |
15 | | | | | | | | | | | |
16 | | [People](PEOPLE.md#people) | [Local Reqs](LOCAL.md#local-requirements) | [Source Code](CODE.md#source-code) | [Integration](INTEGRATION.md#continuous-integration) | [Deployment](DEPLOYMENT.md#continuous-deployment) | [Runtime](RUNTIME.md#runtime) | [Hardware](HARDWARE.md#hardware) | [DNS](DNS.md#dns) | [Services](SERVICES.md#services) | [Cloud](CLOUD.md#cloud-resources)
17 |
18 |
19 |
20 | ## Continuous Integration
21 |
22 | Continuous integration (CI) is the process of automatically integrating code changes from multiple contributors into a single software project. This is an important DevOps best practice that enables developers to frequently merge code changes into a central repository for testing before deployment. Automated tools are used to check that the new code is correct before integration.
23 |
24 | ### What's in scope?
25 |
26 | * SCM providers
27 | * Pull requests
28 |
29 | ### Examples
30 |
31 | #### SCM Providers
32 |
33 |
34 |
35 | ### Who owns it?
36 |
37 | * Engineering leadership
38 | * DevOps team
39 |
40 | ### What are the security concerns?
41 |
42 | * Teams are moving fast, and interating quickly. It's important that we address security at the speed of iteration
43 | * Use automated security controls to make sure that code is always promoted using guardrails
44 | * Verify developers are who they say they are
45 | * User roles define access
46 |
47 | ### How do I secure it?
48 |
49 | * Git commit signing
50 | * SSH keys for SCM provider
51 | * Pull requests
52 | * Branch protection
53 | * Permissions based SCM roles
54 | * MFA for SCM provider
55 |
56 |
--------------------------------------------------------------------------------
/docs/LOCAL.md:
--------------------------------------------------------------------------------
1 |
2 |
3 | ## The Software Supply Chain Stages
4 |
5 | | [People](PEOPLE.md#people) | [Local Reqs](LOCAL.md#local-requirements) | [Source Code](CODE.md#source-code) | [Integration](INTEGRATION.md#continuous-integration) | [Deployment](DEPLOYMENT.md#continuous-deployment) | [Runtime](RUNTIME.md#runtime) | [Hardware](HARDWARE.md#hardware) | [DNS](DNS.md#dns) | [Services](SERVICES.md#services) | [Cloud](CLOUD.md#cloud-resources)
6 | | :---------: | :----------: | :--------------: | :-----------: | :------------------: | :-----------------: | :---------: | :------: | :----------------: | :---------:
7 | | | | | | | | | | | |
8 | | Developers | IDE | Languages | SCM providers | Build solutions | Servers | Embedded PC | URL | SaaS solutions | CDN |
9 | | QA team | SCV | Frameworks | Pull requests | Deployment platforms | Operating systems | PCB | hostname | Third party APIs | Cloud services |
10 | | DevOps team | Local tests | Libraries | Secrets mgmt | Releases | Webservers | USB dongle | | Payment gateways | |
11 | | Package Maintainers | Git repos | Package Managers | Git repos | Functional tests | Application servers | GPU/CPU | | Identity Providers | |
12 | | | Page Builders | Packages | | Security tests | Web engines | | | Analytics | |
13 | | | | Open source | | API test frameworks | Databases | | | Proxies | |
14 | | | | Proprietary Code | | Unit tests | | | | | |
15 | | | | | | | | | | | |
16 | | [People](PEOPLE.md#people) | [Local Reqs](LOCAL.md#local-requirements) | [Source Code](CODE.md#source-code) | [Integration](INTEGRATION.md#continuous-integration) | [Deployment](DEPLOYMENT.md#continuous-deployment) | [Runtime](RUNTIME.md#runtime) | [Hardware](HARDWARE.md#hardware) | [DNS](DNS.md#dns) | [Services](SERVICES.md#services) | [Cloud](CLOUD.md#cloud-resources)
17 |
18 |
19 |
20 | ## Local Requirements
21 |
22 | This includes any local applications, configurations, or other dependencies that are needed to for the people building software to successfully do their job.
23 |
24 | ### What's in scope?
25 |
26 | * IDE
27 | * Source code versioning tools
28 | * Local tests
29 | * Local git repositories
30 | * Page builders
31 |
32 | ### Examples
33 |
34 | #### IDE
35 |
36 |
37 |
38 | #### SCV Tools
39 |
40 |
41 |
42 | #### Local tests
43 |
44 | Linting, static analysis, software composition analysis
45 |
46 | #### Local git repositories
47 |
48 | Source code stored on devs laptop, private packages, install scripts, deployment scripts
49 |
50 | ### Who owns it?
51 |
52 | * Individual engineers
53 |
54 | ### What are the security concerns?
55 |
56 | * Choice of tools has different security outcomes
57 | * Git has several local security features which are typically not used
58 | * If an IDE is used, what extensions or plugins are enhancing security?
59 | * How do you encouage automated security tests in local environments?
60 | * The development environment should be secured
61 | * What challenges does BYOD bring with it?
62 |
63 | ### How do I secure it?
64 |
65 | * Use of git or other version control systems
66 | * .gitignore files
67 | * Endpoint detection and response (EDR)
68 | * Linting
69 | * Local secret scans
70 | * Local SCA scans
71 | * Pre-commit git hooks
72 |
73 |
--------------------------------------------------------------------------------
/docs/PEOPLE.md:
--------------------------------------------------------------------------------
1 |
2 |
3 | ## The Software Supply Chain Stages
4 |
5 | | [People](PEOPLE.md#people) | [Local Reqs](LOCAL.md#local-requirements) | [Source Code](CODE.md#source-code) | [Integration](INTEGRATION.md#continuous-integration) | [Deployment](DEPLOYMENT.md#continuous-deployment) | [Runtime](RUNTIME.md#runtime) | [Hardware](HARDWARE.md#hardware) | [DNS](DNS.md#dns) | [Services](SERVICES.md#services) | [Cloud](CLOUD.md#cloud-resources)
6 | | :---------: | :----------: | :--------------: | :-----------: | :------------------: | :-----------------: | :---------: | :------: | :----------------: | :---------:
7 | | | | | | | | | | | |
8 | | Developers | IDE | Languages | SCM providers | Build solutions | Servers | Embedded PC | URL | SaaS solutions | CDN |
9 | | QA team | SCV | Frameworks | Pull requests | Deployment platforms | Operating systems | PCB | hostname | Third party APIs | Cloud services |
10 | | DevOps team | Local tests | Libraries | Secrets mgmt | Releases | Webservers | USB dongle | | Payment gateways | |
11 | | Package Maintainers | Git repos | Package Managers | Git repos | Functional tests | Application servers | GPU/CPU | | Identity Providers | |
12 | | | Page Builders | Packages | | Security tests | Web engines | | | Analytics | |
13 | | | | Open source | | API test frameworks | Databases | | | Proxies | |
14 | | | | Proprietary Code | | Unit tests | | | | | |
15 | | | | | | | | | | | |
16 | | [People](PEOPLE.md#people) | [Local Reqs](LOCAL.md#local-requirements) | [Source Code](CODE.md#source-code) | [Integration](INTEGRATION.md#continuous-integration) | [Deployment](DEPLOYMENT.md#continuous-deployment) | [Runtime](RUNTIME.md#runtime) | [Hardware](HARDWARE.md#hardware) | [DNS](DNS.md#dns) | [Services](SERVICES.md#services) | [Cloud](CLOUD.md#cloud-resources)
17 |
18 |
19 |
20 | ## People
21 |
22 | These are the individuals or teams of people that are needed to write, build and deploy software.
23 |
24 | ### What's in scope?
25 |
26 | * Software engineers
27 | * QA engineers
28 | * DevOps team
29 | * Package maintainers
30 |
31 | ### Examples
32 |
33 | #### Developers
34 |
35 | 
36 |
37 | ### Who owns it?
38 |
39 | * Individual engineers
40 |
41 | ### What are the security concerns?
42 |
43 | * How do we help our software engineers see security as a "skill" not a burden?
44 | * Package maintainers are a high profile targets.
45 | * What security controls can we suggest that don't slow down devs?
46 | * Security awareness training needs to be ongoing, not once a year
47 | * Help devs understand that finding security issues early saves them significant time later
48 |
49 | ### How do I secure it?
50 |
51 | * Secure Code Training
52 | * Security chanpion mentoring
53 | * Peer code review
54 | * Threat modeling
55 |
56 |
--------------------------------------------------------------------------------
/docs/RUNTIME.md:
--------------------------------------------------------------------------------
1 |
2 |
3 | ## The Software Supply Chain Stages
4 |
5 | | [People](PEOPLE.md#people) | [Local Reqs](LOCAL.md#local-requirements) | [Source Code](CODE.md#source-code) | [Integration](INTEGRATION.md#continuous-integration) | [Deployment](DEPLOYMENT.md#continuous-deployment) | [Runtime](RUNTIME.md#runtime) | [Hardware](HARDWARE.md#hardware) | [DNS](DNS.md#dns) | [Services](SERVICES.md#services) | [Cloud](CLOUD.md#cloud-resources)
6 | | :---------: | :----------: | :--------------: | :-----------: | :------------------: | :-----------------: | :---------: | :------: | :----------------: | :---------:
7 | | | | | | | | | | | |
8 | | Developers | IDE | Languages | SCM providers | Build solutions | Servers | Embedded PC | URL | SaaS solutions | CDN |
9 | | QA team | SCV | Frameworks | Pull requests | Deployment platforms | Operating systems | PCB | hostname | Third party APIs | Cloud services |
10 | | DevOps team | Local tests | Libraries | Secrets mgmt | Releases | Webservers | USB dongle | | Payment gateways | |
11 | | Package Maintainers | Git repos | Package Managers | Git repos | Functional tests | Application servers | GPU/CPU | | Identity Providers | |
12 | | | Page Builders | Packages | | Security tests | Web engines | | | Analytics | |
13 | | | | Open source | | API test frameworks | Databases | | | Proxies | |
14 | | | | Proprietary Code | | Unit tests | | | | | |
15 | | | | | | | | | | | |
16 | | [People](PEOPLE.md#people) | [Local Reqs](LOCAL.md#local-requirements) | [Source Code](CODE.md#source-code) | [Integration](INTEGRATION.md#continuous-integration) | [Deployment](DEPLOYMENT.md#continuous-deployment) | [Runtime](RUNTIME.md#runtime) | [Hardware](HARDWARE.md#hardware) | [DNS](DNS.md#dns) | [Services](SERVICES.md#services) | [Cloud](CLOUD.md#cloud-resources)
17 |
18 |
19 |
20 | ## Runtime
21 |
22 | The web application runtime is the environment in which a web application is executed. It typically includes the web server, the application server, and other necessary components such as databases, messaging systems, and caching mechanisms. The runtime is responsible for managing the application's resources, handling incoming requests, and returning responses to users.
23 |
24 | ### What's in scope
25 |
26 | * Operating systems
27 | * Webservers
28 | * Application servers
29 | * Content management systems
30 | * Web runtime engines
31 | * Databases
32 | * Containers, AMIs & golden images
33 |
34 | ### Examples
35 |
36 | #### Operating systems
37 |
38 |
39 |
40 | #### Webservers
41 |
42 |
43 |
44 | #### Application servers
45 |
46 |
47 |
48 | #### Content management systems
49 |
50 |
51 |
52 | Clarity, Kentico, Sharepoint, Adobe Experience Manager
53 |
54 | #### Web runtime
55 |
56 | Node.js, WebKit, Chrome, V8
57 |
58 | #### Databases
59 |
60 |
61 |
62 | #### Containers, AMIs & Golden Images
63 |
64 |
65 |
66 | ### Who owns it?
67 |
68 | * CloudOps team
69 | * Operations teams
70 |
71 | ### Security concerns with runtime components?
72 |
73 | * Traditional concerns around server security: patching, firewalls, user access, etc
74 | * Container origin is a huge concern as Docker hub and container registries are prime areas for dependency attacks
75 | * Runtime components have multiple layers of user access controls to worry about
76 | * Golden images and AMIs don't age well, and are often "pinned" in launch
77 |
78 | ### How do I secure it?
79 |
80 | * Centralized logging
81 | * SIEM
82 | * Intrusion detection/prevention
83 | * OS hardening
84 | * Web appliation firewall
85 | * Container scanning
86 | * IaC scans
87 |
--------------------------------------------------------------------------------
/docs/SERVICES.md:
--------------------------------------------------------------------------------
1 |
2 |
3 | ## The Software Supply Chain Stages
4 |
5 | | [People](PEOPLE.md#people) | [Local Reqs](LOCAL.md#local-requirements) | [Source Code](CODE.md#source-code) | [Integration](INTEGRATION.md#continuous-integration) | [Deployment](DEPLOYMENT.md#continuous-deployment) | [Runtime](RUNTIME.md#runtime) | [Hardware](HARDWARE.md#hardware) | [DNS](DNS.md#dns) | [Services](SERVICES.md#services) | [Cloud](CLOUD.md#cloud-resources)
6 | | :---------: | :----------: | :--------------: | :-----------: | :------------------: | :-----------------: | :---------: | :------: | :----------------: | :---------:
7 | | | | | | | | | | | |
8 | | Developers | IDE | Languages | SCM providers | Build solutions | Servers | Embedded PC | URL | SaaS solutions | CDN |
9 | | QA team | SCV | Frameworks | Pull requests | Deployment platforms | Operating systems | PCB | hostname | Third party APIs | Cloud services |
10 | | DevOps team | Local tests | Libraries | Secrets mgmt | Releases | Webservers | USB dongle | | Payment gateways | |
11 | | Package Maintainers | Git repos | Package Managers | Git repos | Functional tests | Application servers | GPU/CPU | | Identity Providers | |
12 | | | Page Builders | Packages | | Security tests | Web engines | | | Analytics | |
13 | | | | Open source | | API test frameworks | Databases | | | Proxies | |
14 | | | | Proprietary Code | | Unit tests | | | | | |
15 | | | | | | | | | | | |
16 | | [People](PEOPLE.md#people) | [Local Reqs](LOCAL.md#local-requirements) | [Source Code](CODE.md#source-code) | [Integration](INTEGRATION.md#continuous-integration) | [Deployment](DEPLOYMENT.md#continuous-deployment) | [Runtime](RUNTIME.md#runtime) | [Hardware](HARDWARE.md#hardware) | [DNS](DNS.md#dns) | [Services](SERVICES.md#services) | [Cloud](CLOUD.md#cloud-resources)
17 |
18 |
19 |
20 | ## Services
21 |
22 | This refers to the process of identifying and describing the external services that a application relies on in order to function properly. These third-party services can include anything from authentication and authorization services to payment processing and analytics tools.
23 |
24 | ### What's in scope?
25 |
26 | * third party SaaS solutions
27 | * third party APIs or data
28 | * payment processors/gateways
29 | * identity providers
30 | * analytics & tracking
31 |
32 | ### Examples
33 |
34 | #### Payment gateways & processors
35 |
36 |
37 |
38 | #### SaaS solutions examples
39 |
40 |
41 |
42 | #### Analytics & tracking examples
43 |
44 |
45 |
46 | ### Who owns it?
47 |
48 | * CloudOps team
49 | * Marketing team
50 |
51 | ### How do I secure it?
52 |
53 | * Centralized audit logs
54 | * Vendor key management
55 | * Content security policy
56 | * Just in time access control
57 |
--------------------------------------------------------------------------------
/docs/images/.DS_Store:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/.DS_Store
--------------------------------------------------------------------------------
/docs/images/Software-Supply-Chain-Visualization.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/Software-Supply-Chain-Visualization.png
--------------------------------------------------------------------------------
/docs/images/akamai.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/alibaba-cloud.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/alibaba-cloud.png
--------------------------------------------------------------------------------
/docs/images/amazon-linux-logo.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/amazon-linux-logo.png
--------------------------------------------------------------------------------
/docs/images/amazon-linux.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/amazon-linux.png
--------------------------------------------------------------------------------
/docs/images/angular.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/aspnet.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/aspnet.png
--------------------------------------------------------------------------------
/docs/images/atom.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/atom.png
--------------------------------------------------------------------------------
/docs/images/aws-api-gateway.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/aws-cognito.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/azure-devops.svg:
--------------------------------------------------------------------------------
1 |
2 |
--------------------------------------------------------------------------------
/docs/images/azure-repos.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/azure-repos.png
--------------------------------------------------------------------------------
/docs/images/azure.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/bamboo.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/bamboo.png
--------------------------------------------------------------------------------
/docs/images/bitbucket.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/braintree.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/braintree.png
--------------------------------------------------------------------------------
/docs/images/buildkite.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/buildkite.png
--------------------------------------------------------------------------------
/docs/images/clearcase.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/clearcase.png
--------------------------------------------------------------------------------
/docs/images/cloud-ssc.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/cloud-ssc.png
--------------------------------------------------------------------------------
/docs/images/cloudflare.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/cloudfront.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/codecommit.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/codecommit.png
--------------------------------------------------------------------------------
/docs/images/collaborators-github.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/collaborators-github.png
--------------------------------------------------------------------------------
/docs/images/collaborators-github2.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/collaborators-github2.png
--------------------------------------------------------------------------------
/docs/images/composer.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/composer.png
--------------------------------------------------------------------------------
/docs/images/contentful.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/cplusplus.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/cplusplus.png
--------------------------------------------------------------------------------
/docs/images/crunchbase.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/crunchbase.png
--------------------------------------------------------------------------------
/docs/images/csharp.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/csharp.png
--------------------------------------------------------------------------------
/docs/images/deployment-ssc.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/deployment-ssc.png
--------------------------------------------------------------------------------
/docs/images/django.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/dns-ssc.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/dns-ssc.png
--------------------------------------------------------------------------------
/docs/images/docker.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/docker.png
--------------------------------------------------------------------------------
/docs/images/drupal.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/facebook.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/fastapi.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/fastly.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/flywheel.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/freebsd.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/freebsd.png
--------------------------------------------------------------------------------
/docs/images/git.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/gitea.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/gitea.png
--------------------------------------------------------------------------------
/docs/images/github-visualizing-software-supply-chain.jpeg:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/github-visualizing-software-supply-chain.jpeg
--------------------------------------------------------------------------------
/docs/images/gitlab.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/glassfish.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/glassfish.png
--------------------------------------------------------------------------------
/docs/images/go.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/google-analytics.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/google-cloud.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/hardware-ssc.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/hardware-ssc.png
--------------------------------------------------------------------------------
/docs/images/hotjar.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/hubspot.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/integration-ssc.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/integration-ssc.png
--------------------------------------------------------------------------------
/docs/images/java.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/javascript.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/jenkins.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/joomla.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/joomla.png
--------------------------------------------------------------------------------
/docs/images/jquery.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/kinsta.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/knockout.svg:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/knockout.svg
--------------------------------------------------------------------------------
/docs/images/kubernetes.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/laravel.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/linkedin.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/local-ssc.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/local-ssc.png
--------------------------------------------------------------------------------
/docs/images/lua.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/magento.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/mailchimp.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/marketo.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/mercurial.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/mercurial.png
--------------------------------------------------------------------------------
/docs/images/microsoft-iis-logo.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/microsoft-iis-logo.png
--------------------------------------------------------------------------------
/docs/images/mixpanel.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/mixpanel.png
--------------------------------------------------------------------------------
/docs/images/moment-js.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/mysql.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/netcore.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/next-js.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/nginx.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/npm.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/npm.png
--------------------------------------------------------------------------------
/docs/images/nuget.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/nuget.png
--------------------------------------------------------------------------------
/docs/images/nuxt-js.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/octopus-deploy.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/octopus-deploy.png
--------------------------------------------------------------------------------
/docs/images/octopus-deploy.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/packagist.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/packagist.png
--------------------------------------------------------------------------------
/docs/images/paypal.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/peakhour.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/peakhour.png
--------------------------------------------------------------------------------
/docs/images/people-ssc.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/people-ssc.png
--------------------------------------------------------------------------------
/docs/images/postgres.svg:
--------------------------------------------------------------------------------
1 |
2 |
4 |
5 |
6 |
7 |
8 |
9 |
10 |
11 |
12 |
13 |
14 |
15 |
16 |
17 |
18 |
19 |
20 |
21 |
22 |
--------------------------------------------------------------------------------
/docs/images/pypi.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/pypi.png
--------------------------------------------------------------------------------
/docs/images/python.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/react.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/redhat.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/redhat.png
--------------------------------------------------------------------------------
/docs/images/redhat.svg:
--------------------------------------------------------------------------------
1 |
2 |
18 |
20 |
21 |
23 | image/svg+xml
24 |
26 |
27 |
28 |
29 |
30 |
54 |
56 |
58 |
59 |
65 |
69 |
70 |
--------------------------------------------------------------------------------
/docs/images/redis.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/require-js.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/ruby-on-rails.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/ruby.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/runtime-ssc.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/runtime-ssc.png
--------------------------------------------------------------------------------
/docs/images/rust.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/segment.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/services-ssc.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/services-ssc.png
--------------------------------------------------------------------------------
/docs/images/slick.svg:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/slick.svg
--------------------------------------------------------------------------------
/docs/images/source-code-ssc.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/source-code-ssc.png
--------------------------------------------------------------------------------
/docs/images/square.jpeg:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/square.jpeg
--------------------------------------------------------------------------------
/docs/images/ssc-new-image.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/ssc-new-image.png
--------------------------------------------------------------------------------
/docs/images/stripe.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/swiper.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/tailwind.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/tomcat.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/ubuntu.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/underscore.svg:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/underscore.svg
--------------------------------------------------------------------------------
/docs/images/unix.svg:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
16 |
35 |
37 |
42 |
45 |
49 |
52 |
55 |
58 |
61 |
62 |
63 |
64 |
65 |
--------------------------------------------------------------------------------
/docs/images/vercel.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/vim.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/vim.png
--------------------------------------------------------------------------------
/docs/images/vscode.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/vscode.png
--------------------------------------------------------------------------------
/docs/images/vue.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/websphere.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/websphere.png
--------------------------------------------------------------------------------
/docs/images/windows-server.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/docs/images/yarn.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SecureStackCo/visualizing-software-supply-chain/7e1ec21075c563855e8e2ec071f5e6103cfee216/docs/images/yarn.png
--------------------------------------------------------------------------------